AccessData. Triage. Quick Start Guide

Transcription

1 AccessData Triage Quick Start Guide 3

2 AccessData Legal and Contact Information Document date: October 16, 2013 Legal Information 2013 AccessData Group, Inc All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. AccessData Group, Inc makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, Inc reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, AccessData Group, Inc makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, Inc reserves the right to make changes to any and all parts of AccessData software, at any time, without any obligation to notify any person or entity of such changes. You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside. AccessData Group, Inc. 588 West 400 South Suite 350 Lindon, Utah U.S.A. AccessData Trademarks and Copyright Information AccessData is a registered trademark of AccessData Group, Inc. Distributed Network Attack is a registered trademark of AccessData Group, Inc. DNA is a registered trademark of AccessData Group, Inc. Forensic Toolkit is a registered trademark of AccessData Group, Inc. FTK is a registered trademark of AccessData Group, Inc. Password Recovery Toolkit is a registered trademark of AccessData Group, Inc. PRTK is a registered trademark of AccessData Group, Inc. 4

3 Registry Viewer is a registered trademark of AccessData Group, Inc. A trademark symbol (,, etc.) denotes an AccessData Group, Inc. trademark. With few exceptions, and unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark and copyright holders. AccessData claims no responsibility for the function or performance of third-party products. Third party acknowledgements: FreeBSD Copyright The FreeBSD Project. AFF and AFFLIB Copyright 2005, 2006, 2007, 2008 Simson L. Garfinkel and Basis Technology Corp. All rights reserved. Copyright Ayende Rahien Registration The AccessData product registration is done at AccessData after a purchase is made, and before the product is shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your purchase. Subscriptions AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows you to access technical support, and to download and install the latest releases for your licensed products during the active license period. Following the initial licensing period, a subscription renewal is required annually for continued support and for updating your products. You can renew your subscriptions through your AccessData Sales Representative. Use LicenseManager to view your current registration information, to check for product updates and to download the latest product versions, where they are available for download. You can also visit our web site, anytime to find the latest releases of our products. For more information, see Managing Licenses in your product manual or on the AccessData web site. AccessData Contact Information Your AccessData Sales Representative is your main contact with AccessData Group, Inc. Also, listed below are the general AccessData telephone number and mailing address, and telephone numbers for contacting individual departments. 5

4 Mailing Address and General Phone Numbers You can contact AccessData in the following ways: AD Mailing Address, Hours, and Department Phone Numbers Corporate Headquarters: General Corporate Hours: State and Local Law Enforcement Sales: AccessData Group, Inc. 588 West 400 South Suite 350 Lindon, UT USA Voice: Fax: Monday through Friday, 8:00 AM 5:00 PM (MST) AccessData is closed on US Federal Holidays Voice: , option 1 Fax: Sales@AccessData.com Federal Sales: Voice: , option 2 Fax: Sales@AccessData.com Corporate Sales: Voice: , option 3 Fax: Sales@AccessData.com Training: Voice: , option 6 Fax: Training@AccessData.com Accounting: Voice: , option 4 Technical Support Free technical support is available on all currently licensed AccessData products. You can contact AccessData Customer and Technical Support in the following ways: AD Customer & Technical Support Contact Information Standard Support: After Hours Phone Support: After Hours -only Support: Standard Support: Monday through Friday, 5:00 AM 6:00 PM (MST), except corporate holidays. Voice: , option 5 Voice: (Toll-free North America) Support@AccessData.com Monday through Friday 6:00 PM to 1:00 AM (MST), except corporate holidays. Voice: , option 5 Monday through Friday 1:00 AM to 5:00 AM (MST), except corporate holidays. afterhours@accessdata.com Monday through Friday, 8:00 AM 5:00 PM (UK- London), except corporate holidays. Voice: (United Kingdom) emeasupport@accessdata.com 6

5 AD Customer & Technical Support Contact Information (Continued) After Hours Support: After Hours -only Support: Web Site: Monday through Friday, 5:00 PM to 1:00 AM (UK/ London), except corporate holidays. Voice: Option 5*. Monday through Friday, 1:00 AM to 5:00 AM (UK/ London), except corporate holidays. The Support web site allows access to Discussion Forums, Downloads, Previous Releases, our Knowledgebase, a way to submit and track your trouble tickets, and in-depth contact information. Note: All support inquiries are typically responded to within one business day. If there is an urgent need for support, contact AccessData by phone during normal business hours. Professional Services The AccessData Professional Services staff comes with a varied and extensive background in digital investigations including law enforcement, counter-intelligence, and corporate security. Their collective experience in working with both government and commercial entities, as well as in providing expert testimony, enables them to provide a full range of computer forensic and ediscovery services. At this time, Professional Services provides support for sales, installation, training, and utilization of FTK, FTK Pro, Enterprise, ediscovery, and Lab. They can help you resolve any questions or problems you may have regarding these products Contact Information for Professional Services Contact AccessData Professional Services in the following ways: AccessData Professional Services Contact Information Contact Method Number or Address Phone Washington DC: North America: North America Toll Free: , option 7 International: adservices@accessdata.com 7

6 AD Triage Quick Start Guide AD Triage is designed to collect and review data/artifacts from a live or powered down target system and facilitate the transfer of that data to an administrator system. An AD1 logical image of the systems artifacts can then be written to the destination of your choice. From there, the data can be decrypted and imported into the administrator s interface for further review and reporting or can be consumed by FTK for more advanced analysis. This guide is designed to walk you through a basic workflow of the Triage system. This is not a comprehensive guide, but an abbreviated guide for common tasks. See the AccessData Triage User Guide for a complete description of AD Triage features. Installing AD Triage Before you install AD Triage, you must have the following items: A CodeMeter dongle that is licensed for AD Triage and plugged into the Admin machine CodeMeter Runtime 4.5 installed on your system Microsoft.NET 4.0 SP1 To install AD Triage Admin 1. Insert installation disk into the CD/DVD drive. 2. In the autorun window, click Install Triage Admin. 3. Follow the installation wizard, allowing default folders and options. Licensing a USB Device To collect data from a target system, you must create a Triage USB device with a Triage profile on it. Before you can apply a profile to a device for collection, you must first license the device. You have a limited number of licenses depending on what you purchased. To license a USB device 1. Select Start > Programs > AccessData > Triage > Triage Admin. Licensing a USB Device 8

7 Triage Admin Console Admin Tab 2. Attach the USB device (minimum 400mb). 3. Select the Admin tab and then click Manage Licenses. Manage Licenses Dialog 4. Select the USB device from the Unlicensed Devices pane and click License Device. Licensing a USB Device 9

8 Format Triage Device Dialog 5. Label and Format the USB device. Note: Formatting the device will erase all data currently on the device. The device appears in the Licensed Devices pane of the Manage License dialog. 6. Close the Manage Licenses dialog. Creating a Standard Triage USB Device 1. In the Admin console, click the Devices tab. 2. Click the Standard Triage Device button. 3. Enter a Case Name, select the USB device, and click Finish. 4. Click OK. Your USB device is now ready for use Creating a Custom USB Device To create a custom Triage USB Device, you must first create a custom profile with the filters and actions that you want the collector to perform. Then, you must apply that profile to the USB device. Creating a Custom Profile To create a custom profile 1. Open the AD Triage Admin main window and select the Configure tab. Creating a Standard Triage USB Device 10

9 AD Triage Admin Main Window Configure Tab 2. Click Manage Profiles. 3. In the Profiles dialog, click New Profile. 4. In the Custom Profile Wizard, click Next. 5. In the Profile Name screen, enter a Name and Description for the profile and then click Next. Custom Profile Wizard Standard Actions Screen 6. In the Standard Actions screen, check the actions from the default list that you want the profile to perform during collection and then click Next. Note: Actions that can be performed only on a live system are listed as (LIVE). All other actions can be performed on either a live system or a shutdown system. Example: If you wanted to search for memory and network items on a live system, you would check (LIVE) Memory Dump under the System check box, then (LIVE) Network Adapters and (LIVE) Network Connections under the Network check box. Creating a Custom USB Device 11

10 Note: All standard actions are selected by default. Custom Profile Wizard Custom File Filters Screen 7. In the Custom File Filters screen, click Create Your Own Filter to create your own custom filter. 8. In the Custom Filter Wizard, click Next. 9. In the Filter Name screen, enter a Name and Description for the filter and then click Next. Custom Filter Wizard Select Criteria Screen 10. In the Select Criteria screen, check the types of groups you want included in your custom filter and then click Next. Creating a Custom USB Device 12

11 Custom Filter Wizard Groups Screen 11. Depending on the groups that you checked, the next screen allows you to add the specific criteria for each group to the custom filter. The following screens may appear: Keyword Hash Regular Expression File Size Note:When applying a File Size filter, the filter will search for the Size on Disk file capacity rather than the Size capacity when collecting data. Increase the size of your file search accordingly to accommodate this. Date Time Extensions Path Filename Explicit Image Detection Note: Multiple conditions added under a single group name are considered as an OR condition. Each separate group name added is considered as an AND condition. Example 1: If you wanted to create a filter that searches for.doc files created in the last week, you would perform the following actions: 11a. In the Select Criteria screen, check Date Time and Extensions and then click Next. 11b. In the File Date screen, select File created within a week, click Add Existing Filter, and click Next. Creating a Custom USB Device 13

12 11c. In the File Extension screen, select File is a user created file, click Add Existing Filter, and click Next. Example 2: If you wanted to create a filter that searches for image files on the user s home directory, you would perform the following actions: 11a. In the Select Criteria screen, check Extensions and Path and then click Next. 11b. In the File Extension screen, select File is a picture, click Add Existing Filter, and click Next. 11c. In the File Path screen, select File resides in users home directory, click Add Existing Filter, and click Next. 12. Add your criteria for each group and click Next until you reach the Review Custom File Filter Constraints screen. 13. Click Finish. 14. Click OK. You are returned to the Custom File Filters screen. 15. Check the custom filters that you want to add to the profile and then click Next. Custom Profile Wizard Review Selections Screen 16. In the Review Selections screen, review the actions you have selected to ensure that you want them applied to the profile. If you want to remove any of the actions, highlight the item and click the Remove button. 17. Click Finish and click Yes to the message that appears. Applying a Custom Profile to a USB Device After you have created your custom profile, you need to apply the profile to your USB device in order for the device to perform your specified actions during collection. To create a custom USB device 1. In the Admin console, click on the Devices tab. 2. Click on the Custom Triage Devices button. 3. In the Custom Collector Wizard Welcome screen, click Next. Creating a Custom USB Device 14

13 Custom Collector Wizard Select Profile Screen 4. In the Select Profile screen, select the profile(s) that you want to use during collection and click Next. Custom Collector Wizard Select Triage Device Screen 5. In the Select Triage Device screen, enter a Case Name and Agent Name for the device. 6. Select the USB device that you want to make into a Triage device. Creating a Custom USB Device 15

14 Note: If you do not see the device that you are looking for, ensure that the device is attached to the computer. Then, ensure that the device is licensed. 7. Check to Automatically start collection if you want Triage to automatically collect data on the target system upon start up. 8. Check Automatically export collection if you want Triage to automatically export collected data to the USB device. 9. Check Include file slack space to include slack-space on files during collection. 10. Check Include deleted files to include deleted files during collection. 11. Check Prevent filesystem browsing if you want to prevent the investigator from browsing the file system in the Collection interface. 12. Click Next. 13. Click Finish. Collecting Data from a Target System You can collect data from a shutdown target system or a live system. This section describes both methods. To collect data from a shutdown system 1. Power on the target system and use the keyboard hotkey to boot into the BIOS configuration utility (typically F2 or DEL on most systems). 2. Configure the boot priority of the devices in the BIOS so that it will check for boot devices in this order: CD/DVD Removable (aka USB) Hard Disk Drive (HDD) and other boot devices in any order after that 3. Exit the BIOS configuration utility and save your changes. The system should restart at this point. The AD Triage Agent interface opens. Collecting Data from a Target System 16

15 Agent Interface Window 4. If your device has multiple profiles on it, you will need to select the profile that you want to use from the profiles drop-down. Note: If there are encrypted drives, Triage will notify you as to which drives are encrypted. Data will not be collected from encrypted drives. 5. If you did not select to Auto-Collect or Auto-Export when you created your Triage USB device, click the play button to collect data. When collection is complete, the play button becomes a check mark. 6. Click the Evidence tab, ensure the evidence that you want to export is checked in the Pending Evidence pane, and click Export. Collected data is exported to the USB device. Data that was successfully exported appears in the Successfully Exported pane. When all the evidence has been exported, the Evidence tab appears in green. 7. Click Exit and shut down the system. 8. Remove the USB device. To collect data from a live system 1. Insert the Triage USB device into target system. Collecting Data from a Target System 17

16 2. Do one of the following: In the Windows prompt, select to run AD Triage. Open the devices folder. From the Agent folder, run the TriageAgent. 3. If your device has multiple profiles on it, you will need to select the profile that you want to use from the profiles drop-down. Note: If there are encrypted drives, Triage will notify you as to which drives are encrypted. Data will not be collected from encrypted drives. 4. If you did not select to Auto-Collect or Auto-Export when you created your Triage USB device, click the play button to collect data. When collection is complete, the play button becomes a check mark. 5. Click the Evidence tab, ensure the evidence that you want to export is checked in the Pending Evidence pane, and click Export Now! Collected data is exported to the USB device. Data that was successfully exported appears in the Successfully Exported pane. When all the evidence has been exported, the Evidence tab appears in green. 6. Click Exit. 7. Remove the USB device. Saving, Reviewing, and Exporting Collected Data After you have collected data from a target system, you must bring that data into the Admin console in order to review or export it. To save, review, and export collected data 1. Attach the USB device to the Admin system. 2. Launch the Triage Admin window, select the Devices tab, and click Manage Triage devices. Saving, Reviewing, and Exporting Collected Data 18

17 Manage Triage Devices 3. Select the case from the Profile on Triage Device pane and click Save Collection. The collection is saved in the AD Triage files. 4. Close the dialog. 5. Select the Admin tab and click Manage Saved Collections. Saving, Reviewing, and Exporting Collected Data 19

18 Manage Collections Dialog 6. Select the collection from the Collection pane; use the History Filtering options to find the collection if needed. 7. Click Review Collection to review the collection data and generate reports. Recover Evidence 8. Close the Recover Evidence dialog when you have finished reviewing the data and generating reports. 9. In the Manage Collections dialog, select the collection again and click Export Collection. Saving, Reviewing, and Exporting Collected Data 20

19 10. Browse to the location where you want to export the data and click OK. 11. Click Yes and then OK. Saving, Reviewing, and Exporting Collected Data 21